CVE-2018-6563: totemomail Encryption Gateway: Cross-Site Request Forgery | Rafael Pfister

Analysis on rafaelpfister.ch

Knowledge Base Totemomail: Email Encryption on the Kiteworks Platform The Totemomail encryption gateway in operation: origins and the takeover by Kiteworks, gateway encryption with S/MIME and PGP, WebMail delivery, LDAP integration, the licensing model based on licensed users, and the M365 integration.

Vendor description

Multiple cross-site request forgery (CSRF) vulnerabilities in totemomail Encryption Gateway before 6.0.0_Build_371 allow remote attackers to hijack the authentication of users for requests that (1) change user settings, (2) send emails, or (3) change contact information by leveraging lack of an anti-CSRF token.

Reference data

Vendor

totemo

Affected products

totemomail Encryption Gateway

Published

June 20, 2018

Official sources

← All vulnerabilities